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We introduce a fault-tolerant construction to implement a composite quantum operation of four 
overlapping Toffoli gates. The same construction can produce two independent Toffoli gates. 
This result lowers resource overheads in designs for quantum computers by more than an or- 
der of magnitude. The procedure uses Clifford operations and 64 copies of the non-Clifford gate 
T = exp[i7r(J — <r z )/8]. Quantum codes detect errors in the circuit. When the dominant source of 
error is T-gate failure with probability p, then the composite Toffoli circuit has postselected failure 
rate of 3072p 4 to lowest order. 



I. INTRODUCTION 

Fault-tolerant quantum computing is the research ef- 
fort to make quantum computers reliable despite the 
many ways that quantum hardware suffers from er- 
rors beyond an experimenter's control. Techniques from 
physics, information theory, and computer science are 
employed to develop robust quantum processors. The 
development of quantum error correction was a criti- 
cal result for quantum computing in general, because 
it showed that arbitrarily complex computations could 
be executed on hardware with nonzero error rate [TH5]. 
However, optimism was tempered by the realization that 
the resource overhead (the redundancy in hardware that 
enables error correction) could be several orders of mag- 
nitude larger than a noise-free circuit for plausible error 
rates and interesting quantum algorithms [SHE] ■ Cur- 
rent hardware designs can control fewer than ten quan- 
tum bits [SHU], so the million-qubit devices that imple- 
ment fault-tolerant computation must be several technol- 
ogy generations away from the current state of the art. 
To bridge the gap, research in fault-tolerant quantum 
computing focuses on developing methods to reduce the 
overhead and to perform reliable quantum computing on 
hardware that is simpler to design and fabricate. 

This work addresses the most resource-intensive com- 
ponent in most, if not all, quantum computations. An 
important result from quantum error correction is that, 
in any quantum code, there always exists one crucial op- 
eration that is not natively available jT5J US] , and hence 
it is expensive to prepare. A commonly selected opera- 
tion is the Toffoli gate [TTHTfJ] . defined by £/r f |a, b, c) — 
\a,b,c® ab), where (a,b,c) are binary variables and op- 
eration © is binary XOR. This paper introduces a fault- 
tolerant construction for the Toffoli gate which can sub- 
stantially lower the resource overhead in fault-tolerant 
quantum computing. The two-round error detection in 
this paper is an improvement over the one-round error 
detection in Refs. [T5J Q15]. By incorporating this con- 
struction into recent analyses of fault-tolerant quantum 
architectures H] , we anticipate that the resource costs 



determined therein could be reduced by more than an 
order of magnitude. 

The paper is organized as follows. Section |H] outlines 
some notation and preliminary assumptions. Section |H[| 
summarizes the error-detection methods implemented in 
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the paper. Section IV gives an explicit quantum-circuit 
procedure for producing a composite Toffoli gate. Sec- 
tion [V] calculates the suppressed error probability that 
results from this construction. Section IVII shows how to 
make use of the composite Toffoli gate with teleporta- 
tion. Section |VII| discusses the impact of these results on 
fault-tolerant quantum computing. 



II. PRELIMINARIES 

An important distinction in this paper is made between 
quantum gates that are "easy" and "hard." An operation 
is easy when it has a direct and low-overhead implemen- 
tation within a chosen error-correcting code. Tradition- 
ally, these operations were labeled "transversal," because 
they could be applied element-wise to a code block or 
in matching pairs element-wise between two code blocks, 
which ensured fault tolerance [4]. However, modern codes 
like surface codes [20j [21] do not actually use transversal 
gates. Still, the distinction is important because some 
operations are hard, meaning they require substantially 
more overhead to perform. Often, the hard operations in- 
voke many easy operations to perform some distillation 
procedure [22H25] . 

In the important family of CSS codes [UE], as wen as 
many more stabilizer codes [27] . the easy operations are 
Clifford gates. The group of Clifford gates includes the 
Pauli operators o~ x = X, etc.. The group is generated 
by the phase gate S = exp[«7r(7 — Z)/A], Hadamard H = 
(1/V2)(X + Z), and CNOT. For convenience, we will 
also consider initialization and measurement in the X 
and Z bases to be easy operations, so we may say they 
are "Clifford" although they are not unitary. 

By contrast, non-Clifford gates tend to be much more 
difficult. References [T5] \W\ show that there is always 
one operation required for universal quantum comput- 
ing that is not transversal in a given code. In the sur- 
face code [20l 121] . only a subset of the Clifford group 
is natively available, while the rest must be "injected" 
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into the code space. Injection is not a fault-tolerant 
process, so the injected states must be purified of er- 
rors, which is costly. Distilling the non-Clifford opera- 
tion T = exp[i7r(/ — Z)/8] requires about 50x the circuit 
resources as a fault-tolerant CNOT [21]. This disparity 
motivates our efforts to find a more efficient non-Clifford 
operation in the form of Toffoli gates. Moreover, the 
high cost of fault-tolerant non-Clifford gates (compared 
to Clifford gates) is the justification for another assump- 
tion, that only errors in the non-Clifford T gates are con- 
sidered. 

This paper derives quantum circuits in a way that is 
well-suited to surface code error correction. The features 
of the surface code make some logical code operations 
more convenient than others. In particular, only CNOT, 
Hadamard, and X- and Z-basis initialization and mea- 
surement are natively available [2TJ [2J5] . We later demon- 
strate an ancilla- aided Y"-basis measurement. Rotations 
by angles ir/2 or 7r/4 about the X and Z axes on the 
Bloch sphere are possible but more costly, as they require 
magic-state distillation. We assume that the non-Clifford 
T gate (rotation by 7r/4 around the Z axis) is available 
to produce logical Toffoli gates with error detection. 



III. OVERVIEW OF MAIN RESULTS 

We briefly summarize the main points of the 
composite- Toffoli construction to show what the analysis 
in later sections accomplishes. This high-level descrip- 
tion is also useful for reference. A form of the compos- 
ite Toffoli gate is shown in Fig. [T] which depicts four 
controlled-controlled-Z (CCZ) gates. This circuit has 
flexibility to turn any particular qubit line into Toffoli- 
gate target(s) using Hadamard gates, which are local and 
Clifford. Throughout most of the paper our approach is 
to create the composite-CCZ gate in Fig. [I] and to as- 
sume that the appropriate Hadamard gates are inserted 
when this gate is used in an algorithm. An important 
constraint to note is that these CCZ gates are insepara- 
ble, meaning they must all be implemented in the shown 
arrangement, without inserting any gates in the middle 
of the circuit. 

The composite Toffoli is constructed with two rounds 
of error detection. For now, we consider the only source 
of failure to be T gates having Z errors, each with inde- 
pendent probability p. This simplifies the analysis and al- 
lows us to focus on the non-Clifford gates, which previous 
investigations found to be the most resource-costly com- 
ponent of fault-tolerant quantum computing [7, 8} 1281 150] . 
Each round uses the C4 error-detecting code [5], which 
has distance two and which can detect a single error on 
any qubit. The composite construction with two rounds 
of C4 error detection has distance four with respect to 
T gates. As a result, the distance-four circuit will have 
postselected error of 0(p 4 ). 

In the first round of error detection, a C4 code enables 
the construction of magic states for the controlled-,? gate. 
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FIG. 1. A composite CCZ gate acting on eight qubits, which 
are numbered for later reference. Any qubit line could be 
converted to Toffoli target (s) using Hadamard gates, because 
CCZ is symmetric in its inputs. 



Bare Qubit 1+) ■ 



|0>-$ 
l+>- 
l+>- 



1+) 



H 



H 



H 



H - 



l+>- 
l+>- 



H 



H - 



C 4 Initialization 



FIG. 2. Circuit for constructing the three-qubit register en- 
coding two coupled controlled- H gates. The right-hand side 
shows the equivalent logical circuit. 



The gate S is a Clifford gate, but its controlled version is 
a non-Clifford gate from which Toffoli can be constructed. 
The initial state of the error-detection circuit consists of 
a bare |+> = (1/V2)(|0) + |1)) qubit and a C 4 code block 
with two |+) encoded qubits. The magic-state prepa- 
ration will use four controlled-i? gates produced using 
eight T gates, as we explain later. Because transversal 
H is a logical operation in C4, the controlled- H with the 
control on the bare qubit is also logical with respect to 
the code block [23], as shown in Fig. [5] There are several 
important steps needed to make this process successful, 
and the procedure is detailed in Sec. |IV| Stabilizer mea- 
surements will detect a single error in the code block, and 
we later show that this will detect a single error in any 
of eight T gates used in this procedure. The output is a 
three-qubit magic state that can be used to produce two 
controlled- .S gates with a common control qubit (or com- 
mon target, as controlled-5 is a symmetric operation). 
The error probability for this three-qubit state is 28p 2 . 
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FIG. 3. A high-level depiction of the second round of error 
detection in the composite- Toffoli circuit. Each of the CCZ 
gates requires two controlled-^ gates produced using magic 
states from the first round shown in Fig. [2] The common 
control line from each coupled pair of controlled-.? gates is 
aligned with the top Ca block. The correspondence with Fig.[l] 
is as follows: the bare qubits are inputs (1,2); the pair of 
encoded qubits in each C4 block are inputs (3,4), (5,6), and 
(7, 8), from top to bottom. 



The second round of error detection also uses C4 code 
blocks. Transversal controlled- Z is a logical operation 
between two C4 codes. Similar to above, we imple- 
ment CCZ with a bare qubit controlling a transversal 
controlled- Z operation between C4 codes. CCZ gates are 
constructed using controlled- «S gates, which are supplied 
by the magic states from above. The controlled-,? gates 
act on the C4 blocks, and a single error in any controlled- 
5 gate in each code block can be detected using the sta- 
bilizers of all C4 code blocks. To ensure independence 
of errors, any pair of controlled-5 gates with common 
control must place their targets in separate C4 blocks, as 
explained later. Since these gates are still linked, the fi- 
nal logical operation has common control lines, as shown 
in Fig. § 

The second round of error detection uses eight copies of 
the output of the first round, so 64 T gates are required 
in total. The analysis in Sec. [V] shows that the error 
probability for the output state is 3072p 4 to lowest order. 



After decoding the three C4 blocks, the output state is 
equivalent to the result of applying the composite gate in 
Fig. [I] to eight qubits, each of which is in the |+) state. 
Section |VT| shows how this resource state can teleport the 
composite- Toffoli gate into any quantum circuit. 



IV. ERROR-DETECTION CIRCUITS 

The two rounds of error detection in the composite Tof- 
foli gate are (1) building controlled-5 gates from T gates 
and (2) building CCZ gates from controlled-5 gates. The 
techniques in both rounds are similar, but there are im- 
portant differences as well. In this section, we examine 
the two steps separately for pedagogical clarity. Further- 
more, we assume that Clifford operations are error-free, 
including initialization and measurement, and that the 
only errors come from the non-Clifford T gates. 

The first round of error detection implements transver- 
sal controlled- H gates on a C4 code block. The first detail 
we must address is which implementation of the C4 code 
we use. All implementations are generated by stabilizers 
gi = X\ X2X3X4 and 52 = Z1Z2Z3Z4, where subscript 
on each Pauli operator denotes one of the four qubits 
in the code. However, logical operators can be chosen in 
multiple distinct ways, and this choice determines encod- 
ing/decoding circuits and the set of transversal gates. We 
will label our first implementation the "X /Y encoding" 
because the logical X and Y operators on both encoded 
qubits are weight-2; they can be written as: 

X\ = X1X2 
X2 = X1X3 
Y 1 = Y1Y3 

Y 2 = YiYi, (1) 

where the bar in X\ distinguishes logical code operators 
from physical qubit operators, and subscript corresponds 
to one of the two encoded qubits. Importantly, X/Y 
encoding does not yield a code where transversal CNOT 
implements encoded CNOT. The second implementation 
we use is the standard X/Z encoding [5]: 

X\ = X1X2 
X2 = X1X3 
Z 1 = Z\ Z^ 

Z 2 = Z X Z 2 . (2) 

The X/Z encoding does permit transversal CNOT, and 
conversion between encodings will be necessary to sat- 
isfy our aim of using only X- and Z-axis rotations. Note 
that our derivation using different encodings is just one 
way to explain this circuit. A different interpretation, 
where there is a single fixed encoding and where all op- 
erations that commute with the C4 stabilizers are logical 
operators, is equally valid. 

The X/Y encoding permits a transversal K = 
TXT^ = (1/t/2)(X + Y) operation. In particular, the 
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FIG. 4. Detailed construction of the circuit in Fig. [2] After 
initializing in X/Y encoding, controlled- A" gates are produced 
using T gates and CNOTs. The stabilizer measurement can 
detect a single Z error occurring in any of the T gates. The 
transversal R x (n/2) gates transform the d block to X/Z 
encoding, and in this basis the controlled- if gates are mapped 
to controlled- ii. 



operator U = K1K2K3K4 commutes with the stabilizers 
and implements if 1 if 2 and SWAP on the two encoded 
qubits. Simply put, K interchanges X and Y operators, 
just as Hadamard interchanges X and Z operators; in a 
later step, we map if to H. A similar circuit was used for 
magic-state distillation with the C4 code using the X/Z 
encoding with transversal H |24) . 

Using X /Y encoding, we initialize the circuit to logical 
|+) qubits, apply controlled- if transversally to the code 
block, and verify the result. This procedure is depicted in 
Fig. [4] The initialization procedure prepares two encoded 
|+) qubits as well as a bare |+) qubit. Next, the T gates 
and CNOT perform transversal if 1 if 2 and SWAP con- 
trolled by the bare qubit. Since the encoded qubits are 
identical, the SWAP is trivial. The stabilizer measure- 
ment of the C4 code can detect a single error in any of 
the T gates. 

The final step in this round is to transform this code 
from X/Y to X/Z encoding. The reasons for doing so 
are twofold. The X/Z encoding has simpler decoding 
circuits for the C4 block; alternatively, the X/Z encod- 
ing has transversal, encoded CNOT that enables access 
to the logical state without decoding. The code trans- 
formation is simple and fault-tolerant. Apply transversal 
R x (tt/2) = exp[i7r(7 — X)/A] to each qubit, as shown in 
Fig. [4 This operation maps Y operators to Z opera- 
tors: [R x {ir /2)]Y[R x {-tt /2)] = Z. The stabilizers are 
unchanged, but the encoding of logical operators is mod- 
ified, if maps to H, so the entire circuit is equivalent to 
applying controlled- H transversally to an X/Z-encoded 
C4 block. The reason for the two-step procedure with 
X/Y and X/Z encodings is subtle — it enables bet- 
ter fault-tolerant circuits because stabilizers can be mea- 
sured before and after the R x (n/2) gates in Fig. [4] 

The three-qubit magic state created with (effective) 
controlled- H gates can be used to teleport controlled-S' 



gates. A circuit for doing so is shown in Fig. [5j The 
K-basis measurement is not desirable for surface code 
error correction, but at least one such non-native gate or 
measurement seems necessary. We give a fault-tolerant, 
CVencoded circuit for this measurement at the end of 
this section. The residual gate will be handled in a 
later step. 

The second round of error detection implements 
transversal controlled- Z between two C4 code blocks, 
controlled by a bare qubit, as illustrated in Fig. [3} As be- 
fore, the inputs to the circuit will all be logical |+) qubits. 
Controlled- Z is a transversal operation in C4 codes; the 
logical operation is controlled- Z with swapped targets, 
which is trivial when the targets are identical. CCZ gates 
arc broken down into controlled-S gates. However, the 
controllcd-S magic states from the first round come in 
coupled pairs which must fan out to separate CCZ gates 
to ensure that errors in any one C4 block are independent. 
The resulting arrangement of CCZ gates with common 
controls leads to the composite CCZ operation in Fig. [T] 
A construction for CCZ using controlled-S' magic states is 
shown in Fig.[6j Referring back to Fig.[3j we see that each 
of the four adjacent pairs of coupled-CCZ gates (sharing 
one common control) is implemented by the circuit in 
Fig. [6j Each coupled-CCZ gate uses two copies of Fig. |4j 
or 16 T gates. The entire circuit thus uses 64 T gates. 

Although Fig. [6] builds a coupled pair of CCZ gates, 
each has distance two with respect to T-gate error with 
probability p, resulting in total error probability 56p 2 to 
leading order (using error detection in the first round 
only). By using another round of error detection with 
C4 codes, we can achieve distance four and error prob- 
ability of 3072p 4 for a composite operation of four CCZ 
gates. The next section calculates error probability of 
this composite CCZ gate when one assumes that T gates 
are the dominant failure mechanism. 

The final circuit component we require is a fault- 
tolerant y-basis measurement M y . A simple way to do 
this is to perform the gate R x (n/2) followed by Z-basis 
measurement. However, our circuit constructions use C4- 
encoded qubits, so we would like to perform C4-encoded 
My. The logical operation R x (ir/2) is not transversal in 
C4, so it is not convenient to implement. However, we can 
implement M y using operations transversal in C4 with 
the aid of the ancilla state 5* |+), as shown in Fig. [7^1. 
The F-basis measurement is given by the binary XOR of 
the M x and M z results. By encoding two S^ |+) qubits in 
a C4 code, we can perform encoded M y using transversal 
operations, as shown in FigJTjD. This is fault-tolerant M y 
with respect to the C4 code blocks, because the single- 
qubit measurements can be used to reconstruct both the 
logical K-basis measurements and the stabilizer parity 
measurements for error detection. State S* |+) is not 
natively available in the surface code, so it may require 
distillation [13 031 HE]- The protocol in Ref. [3U (p. 94) 
can be adapted to distilling C4-encoded |+) qubits. 
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FIG. 5. Circuit for teleporting two coupled controlled-.? gates using the magic state (dashed box in upper left) prepared by the 
first round of error detection in Fig. [4] The measurement results are recorded in binary variables (mi, 7712,1713). Subsequent 
corrections are conditionally implemented based on these measurements, with the conditions for each gate given by the binary 
expression above the gate. Overbar here denotes logical inverse, and symbol © denotes binary operation XOR. The Z operator 
in the dashed box is incorporated into the Pauli frame [5J [31] . 
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FIG. 6. Construction of two coupled CCZ gates using teleported controlled-.? gates from Fig. [H] The controlled-S^ gates are 
created by conceptually applying Z and controlled- Z gates after the output of Fig. [5j which in practice is absorbed into the 
existing conditional operations. Note that the residual S and gates cancel. The overbar in each M y measurement symbol 
denotes that controlled- Z gates are conditioned on the qubit being in the (1/V2)([0) — i |1)) state, the (—1) eigenvector of Y. 



V. ERROR ANALYSIS 

Determining the probability of error in the output of 
the composite- Toffoli circuit is simplified by the operat- 
ing assumption that errors only occur in T gates with 
independent probability p. We assume that p <C 1 so 
that the output error is approximated well by the first 
non- vanishing term in a power-series expansion in p, and 
we show that this term is 0(p A ). As before, we analyze 
the two rounds of the protocol, where the second round 
detects some errors missed in the first. 

In the first round of error detection shown in Fig. |1J 
there are eight T gates which may each have a Z error. 
Any single error will be detected by the C4 stabilizers, 
while any combination of two errors will not be detected. 



There are 28 distinct arrangements of two errors, and 
they can be grouped into seven error patterns at the out- 
put. After teleportation of coupled-controlled-.!? gates in 
Fig. [5] the possible error configurations are the seven con- 
figurations of one or more Z errors on the three output 
qubits. Each of these configurations has probability Ap 2 
because each can arise in four different patterns of T-gate 
errors. The total error probability for this operation is 
28p 2 , as expected. 

An important design feature of the composite Toffoli 
gate is that the three outputs of the first round fan out to 
different C4 blocks in the second round. The most likely 
patterns of errors which evade detection in the second 
round are those where two instances of the first round 
both had undetected errors at their respective outputs. 
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FIG. 7. Y-basis measurement using ancillas and operations 
transversal in C4 codes, (a) Logical measurement circuit 
using the S' |+) ancilla state. The measurement result is 
My — mi ® rri2, where © denotes binary XOR. (b) Y-basis 
measurement in C4 code blocks. The dashed box shows an 
encoding circuit for the ancilla block that is prepared, though 
distillation of this register may also be required. Both logi- 
cal Y-basis measurement and code stabilizers can be recon- 
structed from the single-qubit measurements. 



be upper bounded by pf a u < 1 — (1 — p) 64 < 64p. This 
assumes the entire circuit fails on any single T-gate error. 
Less overhead from repeating circuits is required if one 
repeats only the round which failed; if one of the eight 
copies of first-round error detection fails, repeat just that 
circuit rather than the entire composite CCZ gate. To 
accommodate failure, we prepare encoded states before 
teleporting data through the gate. 



VI. TELEPORTATION INTO QUANTUM 
ALGORITHMS 



The composite CCZ operation (or equivalently com- 
posite Toffoli) in Fig. I] can be encoded into a quantum 
register by applying this gate to eight |+) qubits. After 
constructing and verifying this state, the gate interacts 
with data qubits using teleportation, which is an exten- 
sion of the methods developed in Ref. [33]. The telepor- 
tation circuit is shown in Fig. [8j 

If the four coupled CCZ operations are problematic, 
one can sacrifice two CCZ gates to leave two uncoupled 
CCZ gates. Referring to Fig. [TJ if one sets inputs 6 and 
7 to |0) while the others are set to |+), then the second 
and third CCZ gates act trivially. Equivalently, the tele- 
portation circuit in Fig. [8] is modified by deleting lines 
6 and 7, as well as any gates which touch them. As a 
result, two independent CCZ gates are produced. The 
total error probability will be lower because some errors 
become trivial. 



VII. DISCUSSION 



As before, a single error in any C4 block will be de- 
tected, so the two faulty instances of coupled-controlled- 
S must have exactly the same error configuration. If 
not, there will be a single error in at least one block, 
which is detected. None of the C4 codes detect errors 
when any two first-round states have matched errors, so 
these events represent the most likely errors at the out- 
put of the second round. For a few configurations, errors 
from the first round can cancel. Referring to Fig. |6j if 
both coupled-controlled-.? instances have a single Z error 
on the S/S^ qubit, these will cancel without any effect 
on the broader circuit. There are four different possible 
patterns for this event. As a result, undetected output 
errors can occur via six matching first-round error pat- 
terns, each having 28 permutations, or the seventh first- 
round pattern with just 24 permutations (the other four 
self-cancel), which adds up to 192 distinct configurations. 
Each first-round error pattern has probability 4p 2 , so the 
total probability of error in the composite CCZ gate is 
192 x (4p 2 ) 2 = 3072p 4 . 

The use of error detection, instead of correction, im- 
plies that known faulty states are discarded. In such an 
event, some or all of the preparation steps must be re- 
peated. The probability of detected circuit failure can 



Using our results, circuits that depend on Toffoli gates 
have reduced fault-tolerant resource overhead. The pre- 
cise improvement factor depends generally on too many 
parameters and assumptions to be covered here. Instead, 
we give an illustrative example showing how resource 
costs are lowered. Suppose that we are using surface code 
error correction as in Refs. [3 |S] . A typical implementa- 
tion of Shor's algorithm |3U may require an error proba- 
bility per Toffoli gate around 10 -12 . The simplest Toffoli 
circuit uses four T gates, which would each require error 
probability 2 x 10~ 13 . The error-detecting constructions 
in Refs. |T51 [05] require eight T gates with error prob- 
ability 2 x 10~ 7 . Increasing the acceptable probability 
of error means one less round of magic-state distillation 
is required, reducing total resources by about a factor of 
ten [HUH]- Additionally, intermediate Clifford operations 
can use lower code distance [5J. The construction in this 
paper continues this trend. With two rounds of error de- 
tection, the T-gate error probability need only be 1CP 4 . 
Even less magic-state distillation is required in this in- 
stance, and intermediate operations can tolerate higher 
probability of errors. By a cursory resource counting, 
the savings can be a factor of 20 to 50 for producing 
Toffoli gates, using methods developed in Refs. [51 [TB]. 
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FIG. 8. Teleportation circuit for the composite CCZ gate shown in Fig.[T] CCZ gates are symmetric in their inputs, so placing 
Hadamard gates on both sides of the teleportation circuit on the same data qubit will convert the affected CCZ gates to Toffoli 
(targeting this same qubit). Operations in dashed boxes, which are all in the Clifford group, are implemented conditioned on 
the indicated measurement result being logical |1). In many cases, the conditional corrections can be delayed or combined with 
other gates. 



Moreover, error rate 10~ 4 is plausibly achievable by phys- 
ical gates without error correction, which could make 
magic-state distillation unnecessary and save even more 
resources. 

Some important considerations must be mentioned. 
We assumed that non-Clifford operations dominate re- 
source costs, which was borne out in previous investi- 
gations [BHU HE [3U]. However, the composite Toffoli 
changes the situation when its resource cost no longer 
dominates the the total cost of the computation. Other 
operations in a quantum algorithm like routing of qubits 
for long-range interactions may become important. The 
resource savings factor for the entire algorithm will al- 
ways be less than that for the individual Toffoli gates; 
still, most quantum algorithms like factoring [6] El [34] 
and simulation [35] [5B] benefit substantially from a more 
efficient Toffoli construction. 

More research is needed to fully understand resource 
costs of the composite Toffoli construction in the con- 
text of a chosen quantum code. Similar work has been 
performed to optimize magic-state distillation protocols 
implemented in a surface code (28] [30] ■ Our results could 
also be implemented within other codes, such as Bacon- 
Shor codes [37] . In such analysis, another opportunity 



beyond T gates for saving resources is in the Clifford 
gates. We have assumed throughout that Clifford oper- 
ations are perfect, but this is never the case in practice. 
Instead, Clifford operations can have arbitrarily low error 
for some resource cost. The constructions in this paper 
use C4 codes to detect errors in T gates, but they can 
also detect errors in other gates [5]. For example, the 
Clifford operations produced using a surface code could 
have higher error rate if one knew that errors would be 
caught by the C4 error-detection circuits. When higher 
error rates are allowed, lower code distance can be used, 
which means fewer hardware resources are required for 
the same circuit. 

The composite Toffoli gate demonstrates several im- 
portant techniques in fault-tolerant quantum computing 
that merit further investigation. A quantum operation is 
encoded into a known state that is verified before being 
teleported into the rest of the quantum circuit. Early 
work on teleportation gates focused on one-, two-, or 
three-qubit operations [H [33J ; by comparison, the com- 
posite Toffoli gate is an eight-qubit operation. The pro- 
cess of compiling quantum operations into encoded states 
with verification followed by teleportation is a powerful 
technique for generating fault-tolerant quantum circuits. 
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We propose the term quantum logic synthesis for meth- 
ods of synthesizing arbitrary-size, fault-tolerant quantum 
logic networks in a hierarchical arrangement of prepara- 
tion and teleportation. The possible techniques go far 
beyond "sequential" decompositions [SHU where a 
quantum algorithm is decomposed into a long sequence 
of fundamental gates from a small set. For each funda- 



mental gate, fault-tolerant constructions are known, but 
the cost of each is high because every operation must 
have very low error rate. By contrast, hierarchical de- 
signs weave error checking into the algorithm, allowing 
higher error rates throughout. Quantum logic synthe- 
sis can compress larger, more complex operations than 
Toffoli gates, which is the subject of forthcoming work. 
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